Cisco Firepower - Web Servers Policy

STCG — Tue, 28 Apr 2020 08:17:12 GMT

Hi All,

We're looking to make a change to the intrusion policy setup we use on a deployment, currently we have a single 'master' intrusion policy that we apply to all of our access policy rules. What we're looking to do is have a separate policy just for our web servers that'll only use the rule signatures relevant to the traffic (HTTP/S.)

I made a new intrusion policy and used the base policy 'No Rules Active' and then filtered on rules which use the destination port 80/443 and set them to drop and generate events (Aside from the malware CNC.)

I've got a couple of questions just regarding the way I've done this:

Will I run into issues with preprocessors, should I change their state from disabled (Only HTTP/S?)
Is there a better way of working?

Apologies if this is vague, I've not got a lot of experience with Firepower; any help would be appreciated.

topic Cisco Firepower - Web Servers Policy in Network Security

Cisco Firepower - Web Servers Policy